Key data protection information
| Controller | Lajana Sistemas S.L. |
| Purpose | Provide the 21points service, manage your account and billing, respond to your enquiries and produce web analytics. |
| Legal basis | Performance of the contract, consent, legal obligation and legitimate interest. |
| Recipients | Providers acting as data processors (hosting, payments, contact form and analytics). Data is not shared with third parties except where legally required. |
| Rights | Access, rectification, erasure, objection, restriction, portability and to withdraw consent, as well as to lodge a complaint with the AEPD. |
| Further information | Set out in the sections below. |
1. Data controller
The controller of the personal data collected through this website and the 21points application is Lajana Sistemas S.L., with address at Calle Ramón y Cajal 31, Local Izq., 38003 Santa Cruz de Tenerife (Spain). You can contact us at [email protected].
No Data Protection Officer (DPO) has been appointed, as it is not mandatory under Art. 37 GDPR.
2. Scope: when we are controller and when processor
21points is a cloud service (SaaS) for managing 3x3 basketball tournaments and scoreboards. Two situations should be distinguished:
- With regard to your data as a visitor or registered user (account, billing, enquiries), 21points acts as controller and this policy applies in full.
- With regard to the data you, as an organiser, enter about third parties (players, teams, referees, results), you are the controller and 21points acts as a data processor, processing them solely on your instructions and under a data processing agreement (Art. 28 GDPR) available on request. As an organiser, you are responsible for having a legal basis to process such data and, where it includes minors, for obtaining the consent of their parents or guardians.
3. Data we process
- Browsing and contact data: name, email, organisation and the content of your message when you write to us or fill in the form; browsing data collected by analytics cookies if you consent (anonymised IP, pages viewed, device, language).
- Account data: name, email, password (stored encrypted), club or organisation name, language and service preferences.
- Billing and payment data: name or company name, tax ID, billing address and payment history. Payments are processed through Stripe; we do not store your full card details, which are handled directly by Stripe.
- Data entered by the organiser (which we process as a processor): names of players and teams, jersey number, category, date of birth or age, statistics and scores. These may include minors' data.
4. Purposes and legal basis
- Providing the service and managing the account: performance of the contract (Art. 6.1.b GDPR).
- Billing and compliance with accounting and tax obligations: legal obligation (Art. 6.1.c GDPR).
- Processing payments: performance of the contract (Art. 6.1.b GDPR).
- Responding to enquiries (form or email): consent (Art. 6.1.a GDPR) and, where applicable, pre-contractual measures (Art. 6.1.b GDPR).
- Anonymous web analytics: consent (Art. 6.1.a GDPR).
- Service communications (operational notices and updates to customers): legitimate interest (Art. 6.1.f GDPR); purely marketing communications rely on your consent.
- Processing of player and team data: on behalf of the organiser, as a processor (Art. 28 GDPR).
5. Minors
Registration and subscription to the service are intended solely for adults with legal capacity to contract. As regards data of players who may be minors, entered by the organiser: in Spain, under Art. 7 of the LOPDGDD, the processing of data of minors under 14 requires the consent of the holders of parental authority or guardianship. As the organiser, you are responsible for obtaining and keeping such consent before entering minors' data into the platform. 21points does not collect minors' data directly.
6. Retention
- Account data: while the account is active; after closure it is deleted or anonymised within a maximum of 6 months, unless blocked due to a legal obligation.
- Billing data: for the legally required periods (6 years under the Spanish Commercial Code and 4 years for tax purposes under the General Tax Act).
- Contact form data: up to 12 months if it does not lead to a business relationship.
- Tournament and player data (as a processor): while the organiser's account is active or until they delete it or so request; on termination of the service it is returned or deleted according to their instructions.
- Analytics data: according to the periods set out in the cookie policy.
7. Recipients and processors
We do not share your data with third parties, except where legally required (for example, a court or administrative order). To provide the service we rely on providers acting as processors under a contract compliant with Art. 28 GDPR:
- IONOS — hosting of the website and the application, including the database (servers in the European Union).
- Stripe Payments Europe, Ltd. / Stripe, Inc. — payment processing (United States).
- Formspree, Inc. — contact form processing (United States).
- Google — web analytics via Google Analytics 4 (United States).
8. International transfers
The use of Stripe, Formspree and Google Analytics may involve transfers of data to the United States. Such transfers are covered by the safeguards provided for in the GDPR: these providers' adherence to the EU-U.S. Data Privacy Framework and/or the signing of Standard Contractual Clauses approved by the European Commission. Analytics cookies are only loaded if you give your consent.
9. Live streaming via YouTube
If you subscribe to the live streaming add-on, 21POINTS uses the YouTube API Services to publish your tournament's matches on the YouTube channel you authorise us to use.
By connecting your channel, you authorise 21POINTS to create live streams on it, to start and end them, and to set their title, description and thumbnail. 21POINTS does not access your email, your contacts or your personal Google data, and does not modify or delete content on your channel that the application itself did not create.
By using this feature you accept the YouTube Terms of Service. Google's processing of your data is governed by the Google Privacy Policy.
You can revoke access at any time, at no cost and without penalty: from your 21POINTS dashboard (Live streaming → YouTube channel → Disconnect) or from your Google account's permissions page (myaccount.google.com/permissions). Once revoked, scheduled streams will stop working; videos already published remain yours and are not deleted.
The access tokens for your channel are stored encrypted, are not accessible to other organisers and are not shared with third parties.
10. Rights
You may exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, as well as to withdraw the consent given (without affecting the lawfulness of prior processing), by emailing [email protected] and stating the right you wish to exercise. If you believe your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid; aepd.es).
11. Marketing communications
If you receive marketing communications from us, you may object or unsubscribe at any time via the link included in each communication or by writing to [email protected].
12. Automated decisions
We do not make automated decisions or carry out profiling that produces legal effects on you.
13. Security
We apply reasonable technical and organisational measures to protect your data against unauthorised access, loss or alteration: encryption of communications (HTTPS), encrypted password storage, access control and backups.
14. Changes to this policy
We may update this policy to reflect legal or service changes. The date of the last update appears at the top of the document; if the changes are substantial, we will notify you by appropriate means.